We help IT Professionals succeed at work.

We've partnered with Certified Experts, Carl Webster and Richard Faulkner, to bring you two Citrix podcasts. Learn about 2020 trends and get answers to your biggest Citrix questions!Listen Now


PIX 506E problem accessing Internet after hours

afamm asked
Medium Priority
Last Modified: 2010-04-09
I configured PIX 506E restricted device (R-pix-506E-BUN-K9) did not know that Pix 506E has restricted version.
My Story IS!!

I configured the 506E and all users could access the internet and receive and send email as well 2 days ago but yesterday the users could not access the internet.Spoke to ISP and they confirmed that the link was fine. I tested with an old 3com firewall router and it works fine.
I have looked at the fixup and could not find a fixup DNS entry, I tried to put in the command but it won't take it with error " Bad protocol dns".
I am held up hear at this point dont know what has happened.
Any kind of help will be appreciated.
Do i need to activate the Device ?
"Show vers" command shows that its been activated.
My worry is that it worked for some 2 days.
My sample config is below.

PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password encrypted
passwd  encrypted
hostname LA-FW
domain-name LA.com
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
access-list acl_in permit tcp any host X.X.182.153 eq smtp
access-list 102 permit ip
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside X.X.182.153
ip address inside
ip audit info action alarm
ip audit attack action alarm
ip local pool ippool
pdm location inside
pdm location outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 102
nat (inside) 1 0 0
static (inside,outside) tcp X.X.182.153 smtp smtp netmask 255.255
.255.255 0 0
access-group acl_in in interface outside
route outside X.X.182.158 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa-server partnerauth protocol radius
aaa-server partnerauth (inside) host un1v3rs1ty timeout 5
http server enable
http inside
http inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt ipsec pl-compatible
crypto ipsec transform-set strongdes esp-3des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set strongdes
crypto map partner-map 10 ipsec-isakmp dynamic dynmap
crypto map partner-map client authentication partnerauth
crypto map partner-map interface outside
isakmp enable outside
isakmp identity address
isakmp nat-traversal 3600
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup LA address-pool ippool
vpngroup LA dns-server
vpngroup LA wins-server
vpngroup LA idle-time 1800
vpngroup LA password
telnet inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
terminal width 80
: end

Can some one look at my config to identify why this is happening. Basically when I move the connection to a 3com firewall for 30min and connect  back the pix506 it starts working again.
When i do the "show int" command i get the below output.

interface ethernet0 "outside" is up, line protocol is up
  Hardware is i82559 ethernet, address is 000d.bd3c.02eb
  IP address X.X.182.153, subnet mask
  MTU 1500 bytes, BW 10000 Kbit half duplex
        304669 packets input, 241369008 bytes, 0 no buffer
        Received 463 broadcasts, 0 runts, 0 giants
        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
        274255 packets output, 122942548 bytes, 0 underruns
        0 output errors, 4327 collisions, 0 interface resets
        0 babbles, 0 late collisions, 1701 deferred
        1 lost carrier, 0 no carrier
        input queue (curr/max blocks): hardware (128/128) software (0/2)
        output queue (curr/max blocks): hardware (0/26) software (0/3)
interface ethernet1 "inside" is up, line protocol is up
  Hardware is i82559 ethernet, address is 000d.bd3c.02ec
  IP address, subnet mask
  MTU 1500 bytes, BW 100000 Kbit full duplex
        309339 packets input, 121496564 bytes, 0 no buffer
        Received 31047 broadcasts, 0 runts, 0 giants
        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
        300447 packets output, 234414434 bytes, 0 underruns
        0 output errors, 0 collisions, 0 interface resets
        0 babbles, 0 late collisions, 0 deferred
        1 lost carrier, 0 no carrier

I changed the cable from the DSL router to a cross cable and it worked for about 12hrs and stopped allowing users access to the internet but all emails work fine.

Can someone HELP PLEASE!!!?
Watch Question

Les MooreSr. Systems Engineer
Top Expert 2008

>PIX Version 6.3(1)
Does not support dns fixup. You'd have to upgrade to 6.3(5)

There's nothing wrong with the config. If it was a configuration issue it either works or not. If it worked for 12 hours then stops, then it is something else.

Pix is running at half duplex
 MTU 1500 bytes, BW 10000 Kbit half duplex
I see collision counters on the interface, which is expected if both devices are set to half-duplex. Pix is set to auto, and might not be negotiating properly with the DSL router/modem.
What exactly are you connecting the outside interface to? A DSL modem? It could be a duplex mismatch between the DSL and the PIX. You could put a small switch in between them and see if that clears it up.


the outside interface is connected to an SDSL modem and the port says 10baseT.
what kind of switch. Can you give me a sample switch that i couls use please?
Les MooreSr. Systems Engineer
Top Expert 2008



The SDSL modem that i have has four 10baset ports and a cross cable connected from one of the SDSL ports to  the Eternet0 pix 506 interface and from the Ethernet1 of the Pix506 a cable connected to a Netgear Gigabite switch GS748T.
I have also gone ahead to change the ethernet0 port command on the Pix to 10baset (ie. interface ethernet0 10baset)and it runnung on a half duplex connection speed.
The netgear is an autosensing switch and does not have a direct conection with the switch.
Please let me know what you think.


Les MooreSr. Systems Engineer
Top Expert 2008

If it's a 4-port switch on the back of the DSL modem, then a crossover cable would not be needed. Suggest going back to straight-through cable.


Clients are complaining that they cannot get through to some websites.
Any command that will allow these access please?


Also what command would i use for a half duplex connection on the pix?
Sr. Systems Engineer
Top Expert 2008
interface ethernet0 10baset

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts
Les MooreSr. Systems Engineer
Top Expert 2008

Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.


Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.